AI Phishing, Supply Chains, and $3.5B Lost — Crypto’s Brutal 2025

However, some experts believe this attack exposes how the reactive disposition of DeFi security infrastructure makes platforms susceptible to further breaches. Nicolas Vaiman, CEO of Bubblemaps, cites human error as the primary threat to DeFi.

“Even solid platforms can fail when risks build up across infrastructure, wallets, and counterparties without being caught early,” Vaiman asserts. “No matter how strong the technical defenses are, mistakes in operations, access control, or decision-making will always exist.”

Natalie Newson, senior blockchain investigator at Certik, believes decentralized governance and community involvement can be pivotal in thwarting future attacks. However, she notes this will only be possible “with the right balance of transparency, expertise, and rapid-response capability.”

While the Bybit hack was the single largest loss, it accounted for just over two-fifths of the overall losses suffered by crypto platforms in 2025. According to Chainalysis, a further $2 billion was lost to attacks ranging from smart contract exploits to wallet compromises. The Coinbase support system exploit revealed in May saw attackers take funds estimated between $180 million and $400 million. To effect the attack, cybercriminals used AI-powered voice cloning and phishing to bribe or trick overseas support agents. This provided “privileged access” to customer data and internal tools, allowing them to bypass security protocols for high-value accounts.

The Cetus protocol exploit, in which criminals stole $231 million, was the largest decentralized finance ( DeFi)-specific breach of the year. Other platforms suffered notable breaches: Nobitex, an Iranian exchange, was targeted by a group known as “Predatory Sparrow” in a politically motivated attack that disrupted regional liquidity and drained an estimated $90 million.

The Indian exchange Coindcx lost $44 million after suffering unauthorized treasury access due to compromised internal credentials, while Upbit lost $36 million in a breach attributed to North Korean hackers. A supply chain attack where malicious code was injected into third-party software tools used by Bigone resulted in a loss of $27 million.

Meanwhile, Chainalysis data shows a dramatic increase in the proportion of losses coming from individual users rather than services. Personal wallet compromises accounted for only 7.3% of stolen value in 2022 but surged to 44.4% in 2024. While the share of personal wallet losses dropped to 20.6% in 2025, excluding the Bybit attack would bring that figure to 36.8%. The report also noted that centralized platforms were increasingly susceptible to private key compromises throughout the year.

Following the Bybit attack, many exchanges sought to preempt threats by adding protocol-level freezing capabilities. Though controversial, proponents believe these measures effectively stop criminals from cashing out stolen funds. Vaiman believes this capability—already adopted by 16 blockchains—will become more common.

“In practice, the most effective way to stop large-scale crypto crime today is still through stablecoin issuers or CEXs freezing funds,” Vaiman said. “If similar controls are available at the blockchain level, they can help limit damage in clear cases of hacks.”

Conversely, Newson argues for a collaborative framework to address cyber threats. She says the challenge lies in creating operational bridges to facilitate transparency standards and threat signals across ecosystems.

“This is notably what is happening with initiatives like SEAL 911 or the ‘Coalition to Change Crypto Freezes & Recovery’ led by zeroShadow,” Newson said. “The goal is to enable defensive coordination against threats while preserving the openness and innovative potential of Web3.”

FAQ 💡

• What happened in 2025? Bybit suffered a $1.5B hack, the largest DeFi breach in history.
• Who was behind it? The state‑sponsored Lazarus Group executed a supply‑chain exploit via Safe wallet.
• How did Bybit respond? CEO Ben Zhou guaranteed full asset backing and launched a $140M bounty campaign.
• Why does it matter globally? The attack shook markets from the U.S. to Asia, forcing exchanges to adopt stricter security.

Source